Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
15/09/2022, 00:40
Static task
static1
Behavioral task
behavioral1
Sample
1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe
Resource
win10-20220812-en
General
-
Target
1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe
-
Size
718KB
-
MD5
ba041360bc271baae8ac03abc97c6fcd
-
SHA1
5e3c779273edf5ecc7602fb4fc748f563147a70d
-
SHA256
1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb
-
SHA512
dcd666214999d4d80e5cdead5588074e6b314b77006abfe719c1eb1c500525dfc2dda9faaa13cd95be250fc8fbba38ade90c171d36d1596fa178aacd16eb424f
-
SSDEEP
768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 4444 dllhost.exe -
Adds Run key to start application 2 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cortana = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe\\Cortana.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\NvStray = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiMalwareServiceExecutable = "C:\\ProgramData\\Microsoft\\Windows Defender\\Platform\\4.18.2111.5-0\\MsMpEng.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeUpd = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\OneDriveService = "C:\\Program Files\\WindowsApps\\Microsoft.x64__8wekyb3gfdfdgd8bbwe/file.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "C:\\ProgramData\\Dllhost\\dllhost.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Windows\\System32\\SecurityHealthSystray.exe" dllhost.exe Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefender = "C:\\Program Files\\Windows Defender\\MpCmdRun.exe" dllhost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4752 schtasks.exe 3128 schtasks.exe 5044 schtasks.exe 5008 schtasks.exe 5040 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4256 powershell.exe 4256 powershell.exe 4256 powershell.exe 4776 powershell.exe 4776 powershell.exe 4776 powershell.exe 1340 powershell.exe 1340 powershell.exe 1340 powershell.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe 4444 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4256 powershell.exe Token: SeDebugPrivilege 4788 1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe Token: SeDebugPrivilege 4776 powershell.exe Token: SeDebugPrivilege 1340 powershell.exe Token: SeDebugPrivilege 4444 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 4940 4788 1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe 66 PID 4788 wrote to memory of 4940 4788 1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe 66 PID 4788 wrote to memory of 4940 4788 1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe 66 PID 4940 wrote to memory of 4384 4940 cmd.exe 68 PID 4940 wrote to memory of 4384 4940 cmd.exe 68 PID 4940 wrote to memory of 4384 4940 cmd.exe 68 PID 4940 wrote to memory of 4256 4940 cmd.exe 69 PID 4940 wrote to memory of 4256 4940 cmd.exe 69 PID 4940 wrote to memory of 4256 4940 cmd.exe 69 PID 4940 wrote to memory of 4776 4940 cmd.exe 70 PID 4940 wrote to memory of 4776 4940 cmd.exe 70 PID 4940 wrote to memory of 4776 4940 cmd.exe 70 PID 4940 wrote to memory of 1340 4940 cmd.exe 71 PID 4940 wrote to memory of 1340 4940 cmd.exe 71 PID 4940 wrote to memory of 1340 4940 cmd.exe 71 PID 4788 wrote to memory of 4444 4788 1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe 72 PID 4788 wrote to memory of 4444 4788 1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe 72 PID 4788 wrote to memory of 4444 4788 1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe 72 PID 4444 wrote to memory of 416 4444 dllhost.exe 73 PID 4444 wrote to memory of 416 4444 dllhost.exe 73 PID 4444 wrote to memory of 416 4444 dllhost.exe 73 PID 4444 wrote to memory of 492 4444 dllhost.exe 74 PID 4444 wrote to memory of 492 4444 dllhost.exe 74 PID 4444 wrote to memory of 492 4444 dllhost.exe 74 PID 4444 wrote to memory of 2080 4444 dllhost.exe 75 PID 4444 wrote to memory of 2080 4444 dllhost.exe 75 PID 4444 wrote to memory of 2080 4444 dllhost.exe 75 PID 4444 wrote to memory of 2676 4444 dllhost.exe 76 PID 4444 wrote to memory of 2676 4444 dllhost.exe 76 PID 4444 wrote to memory of 2676 4444 dllhost.exe 76 PID 4444 wrote to memory of 4852 4444 dllhost.exe 77 PID 4444 wrote to memory of 4852 4444 dllhost.exe 77 PID 4444 wrote to memory of 4852 4444 dllhost.exe 77 PID 4444 wrote to memory of 4920 4444 dllhost.exe 78 PID 4444 wrote to memory of 4920 4444 dllhost.exe 78 PID 4444 wrote to memory of 4920 4444 dllhost.exe 78 PID 4444 wrote to memory of 3572 4444 dllhost.exe 79 PID 4444 wrote to memory of 3572 4444 dllhost.exe 79 PID 4444 wrote to memory of 3572 4444 dllhost.exe 79 PID 4444 wrote to memory of 4268 4444 dllhost.exe 80 PID 4444 wrote to memory of 4268 4444 dllhost.exe 80 PID 4444 wrote to memory of 4268 4444 dllhost.exe 80 PID 4444 wrote to memory of 4292 4444 dllhost.exe 92 PID 4444 wrote to memory of 4292 4444 dllhost.exe 92 PID 4444 wrote to memory of 4292 4444 dllhost.exe 92 PID 4444 wrote to memory of 1468 4444 dllhost.exe 82 PID 4444 wrote to memory of 1468 4444 dllhost.exe 82 PID 4444 wrote to memory of 1468 4444 dllhost.exe 82 PID 4444 wrote to memory of 4988 4444 dllhost.exe 83 PID 4444 wrote to memory of 4988 4444 dllhost.exe 83 PID 4444 wrote to memory of 4988 4444 dllhost.exe 83 PID 4444 wrote to memory of 2228 4444 dllhost.exe 84 PID 4444 wrote to memory of 2228 4444 dllhost.exe 84 PID 4444 wrote to memory of 2228 4444 dllhost.exe 84 PID 492 wrote to memory of 5040 492 cmd.exe 100 PID 492 wrote to memory of 5040 492 cmd.exe 100 PID 492 wrote to memory of 5040 492 cmd.exe 100 PID 2080 wrote to memory of 5008 2080 cmd.exe 99 PID 2080 wrote to memory of 5008 2080 cmd.exe 99 PID 2080 wrote to memory of 5008 2080 cmd.exe 99 PID 2676 wrote to memory of 5044 2676 cmd.exe 98 PID 2676 wrote to memory of 5044 2676 cmd.exe 98 PID 2676 wrote to memory of 5044 2676 cmd.exe 98 PID 416 wrote to memory of 3128 416 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe"C:\Users\Admin\AppData\Local\Temp\1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"2⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Windows\SysWOW64\chcp.comchcp 12513⤵PID:4384
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4256
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1340
-
-
-
C:\ProgramData\Dllhost\dllhost.exe"C:\ProgramData\Dllhost\dllhost.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:3128
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:5040
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:5008
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:5044
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4852
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4920
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:3572
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"4⤵
- Creates scheduled task(s)
PID:4752
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4268
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk841" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:1468
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6282" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4988
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6249" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:2228
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3731" /TR "C:\ProgramData\Dllhost\dllhost.exe"3⤵PID:4292
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:644
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:4528
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:1388
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:852
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off3⤵PID:2304
-
C:\Windows\SysWOW64\chcp.comchcp 12514⤵PID:1604
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD55e38c6081788423519256d2bdedae7b8
SHA1f74b429a59057d33c2ef5c34f75040b8cf956aae
SHA2562c412977976da5455727cf7c5afced75c62e51b2e9792b964c98e549b880abd5
SHA512f110df24f102ee510ca1ea4e1ca426c14dbdb2b03ef81c74124e708583031c45b117bb2f5c77f15a17b931abb3b0c8c2ad677bacb3a756e723e367b4add35bdb
-
Filesize
896KB
MD55e38c6081788423519256d2bdedae7b8
SHA1f74b429a59057d33c2ef5c34f75040b8cf956aae
SHA2562c412977976da5455727cf7c5afced75c62e51b2e9792b964c98e549b880abd5
SHA512f110df24f102ee510ca1ea4e1ca426c14dbdb2b03ef81c74124e708583031c45b117bb2f5c77f15a17b931abb3b0c8c2ad677bacb3a756e723e367b4add35bdb
-
Filesize
497B
MD513fda2ab01b83a5130842a5bab3892d3
SHA16e18e4b467cde054a63a95d4dfc030f156ecd215
SHA25676973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e
SHA512c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc
-
Filesize
2KB
MD51c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
Filesize
18KB
MD5dc32a421d1e97cb88049f287757e0234
SHA1d5eb5ac51dad7a100b13d16973972f3a6e042a06
SHA256c8546ee958d243dee295515c6471a4304576afbea08626695dfc6e1d51d11134
SHA512e47b5a86ec070d68033ec3aff056b9f5e6e591fbc2dda74a7beed90d8c4365f3c76248e9394dc32ed0648d2ce96855f32e0925a70610bdf3a25110eaded78953
-
Filesize
18KB
MD50bab097c994d7d66c6ceec25ab2b0b0b
SHA1e9800b6c1afe315231a7648cfff24e24ca30c99c
SHA25644e50e91c493dffc88c7d05e89f462e21d9441becf5d014aeab83531a87ed0d8
SHA5120bd26e21156c9a9e062ac58416e3c8be6838cf26092f4af4ce2401207238780869c9ce387a147a98ddecc06ab546415bcb994695ef2a4ede6ad1d37ed182941e